[samgbafa]

Scope

Adds ceremony-scoped recipient keys and bounded sealed-dealing envelopes using RFC 9180 base mode: DHKEM(X25519, HKDF-SHA256), HKDF-SHA256 and ChaCha20Poly1305.

The envelope is 01 || enc:32 || lp(ciphertext), with a 64 KiB complete-message cap. The wrapper binds ceremony digest, round and member indices in info, and the commitment hash in AAD. Transport helpers remain crate-private. This is TC-2220 HPKE transport prework; the DKG state machine and node integration are separate work.

Verification

Final-head acceptance

Exact head 75d966f9ca777a3638b2d071e5a957f37ae88f6f on parent 31d2b2c3866483b119501e4a5041a0d0a104737c, after the single owned-only final restack, fresh integrator wiring and tree-identical identity correction:

• cargo test --locked -p tinycloud-threshold: 55 passed, including all 10 seal tests; PROPTEST_CASES=1024; exit 0.
• cargo clippy --locked -p tinycloud-threshold --all-targets -- -D warnings: exit 0.
• cargo fmt -p tinycloud-threshold -- --check: exit 0.
• cargo deny --manifest-path tinycloud-threshold/Cargo.toml --locked --config tinycloud-threshold/deny.toml check licenses bans advisories sources: pinned 0.20.2, verified binary checksum, exit 0; advisories, bans, licenses and sources all passed.
• Separate standalone non-test executable compiled the actual production modules and recovered the original plaintext from an 85-byte canonical envelope. Changed ceremony, mutated tag and low-order recipient were rejected; compile/run exit 0.

Checks used Rust 1.97.1, two Cargo build jobs and fresh isolated homes/target. No product files changed during final acceptance.

Construction evidence

Construction-head evidence at bff93fa2cf548d593518d40ddb00fd285021e80a:

• Recorded tests-first compiler RED before the implementation.
• cargo test --locked -p tinycloud-threshold: 55 passed, including 10 sealed-dealing tests; PROPTEST_CASES=1024.
• RFC 9180 Appendix A.2.1: exact IKM-derived public keys and encapsulation, six ciphertext/open cases and three exports. Fixture provenance includes verified erratum 7121.
• Context/key binding, envelope mutations, low-order inputs, canonical decoding and size boundaries exercised.
• Scoped all-target clippy with -D warnings, scoped formatting and the pinned cargo-deny 0.20.2 policy passed.
• Standalone non-test executable exercised the actual production modules: plaintext recovered; changed ceremony, mutated tag and low-order recipient rejected.

Storage lifecycle

The wrapper-owned 32-byte key storage uses Zeroize/ZeroizeOnDrop; internal plaintext/candidate buffers and returned plaintext use Zeroizing. Borrowed caller plaintext is not cleared by the module. This description covers accessible owned buffers, not hpke0.12 PrivateKey/AeadCtxS/AeadCtxR internal storage.

Final-parent stack

• Parent: 31d2b2c3866483b119501e4a5041a0d0a104737c.
• Head: 75d966f9ca777a3638b2d071e5a957f37ae88f6f.
• Owned commits: a3d665c68abf74e6104038e2c3c59bbdfafde5d2, 841acd6dcc79d12280783309d6fbdfcd872be4ab, 4dc201e4488065015ffca7ea01db7ca68f67245e.
• Fresh final-parent dependency/lock/error/export/SPEC wiring by the shared integrator: 8312f0800404d250748b73b3b4cce573ed4afd0b, canonical metadata replacement 75d966f9ca777a3638b2d071e5a957f37ae88f6f.
• All unpublished author and committer identities are canonical. The metadata correction preserved every commit tree, message and timestamp.

Construction stack

• Construction parent: d91c16c8e9e4b43006f1a8942952f935a7005c51.
• Tests-only module/dependency wiring by the shared integrator: d1aa10234d9ef0f596af09f7fb518d4152432ce2.
• Owned implementation: 0aee31eaca22921bce6cdcf5f0ef72d6f39506ae.
• Production dependency/error/export/SPEC wiring by the shared integrator: 58cd01e8523a8a342ea6b2c6d26213fc88be4585.
• Verified owned formatting/byte-accessor head: bff93fa2cf548d593518d40ddb00fd285021e80a.

Provenance and dependencies

• RFC 9180, especially sections 6, 7.1.4 and Appendix A.2.1: suite composition, one-shot operation and published known-answer data.
• Verified erratum 7121: corrected published private-key fixture values; comparisons use the IKM-derived public outputs.
• hpke 0.12 API documentation and feature metadata: detached APIs and exact minimal x25519 feature selection.
• hpke 0.13 release documentation: RNG API compatibility comparison. Version 0.12 uses the existing rand_core 0.6.4 boundary.
• zeroize API documentation: accessible owned storage behavior. Rendered X25519 and ChaCha20Poly1305 API documentation was also consulted for type/lifecycle boundaries.
• RustSec package advisory metadata and the crate's explicitly selected dependency policy: resolved dependency review.
• TinyCloud's own specification and design.

Added dependency: hpke = "=0.12.0", defaults disabled, x25519 only, MIT OR Apache-2.0. Existing rand_core, zeroize and the selected dependency closure use permissive licenses checked by the scoped policy. No dependency implementation source was consulted.

Clean-room statement. tinycloud-threshold is written from published papers and standards only: Shamir 1979; Feldman 1987; Pedersen 1991; Gennaro–Jarecki–Krawczyk–Rabin 1999/2007; Boneh–Franklin 2001/2003; Fujisaki–Okamoto 1999; Desmedt–Jajodia 1997; Wong–Wang–Wing 2002; Herzberg–Jarecki–Krawczyk–Yung 1995; CHURP (ePrint 2019/017); vetKeys (ePrint 2023/616); RFC 9380; RFC 9180; the IRTF pairing-friendly-curves draft; and TinyCloud's own design and plan. No source code, tests, issues or other material from TACo, nucypher, nucypher-core, ferveo, umbral or taco-web (GPL-3.0/AGPL-3.0) was opened, fetched, cloned, searched or used. Dependencies are permissively licensed and listed in the PR. Each PR keeps a provenance log of the sources consulted.

Details: TC-2220

[samgbafa]

Actual-main lineage update:

• Base: 00643ae8b445e019b45a03923caf65400102825d (main).
• Head and fresh shared-wiring commit: 59983832277ad6a31efabb3b8f2459017297fa62.
• The three owned seal/fixture commits were replayed without source, test or fixture changes. Their resulting files are byte-identical to reviewed head 75d966f9ca777a3638b2d071e5a957f37ae88f6f:
  • src/seal.rs: blob f9d883fe22a62aada0f0b64453e85ce497bbd054.
  • vectors/v1/hpke-rfc9180-a2-1.json: blob 5257a64837b7b2c6c5edcf5498b6af6c0d25d456.
• The shared integrator freshly applied the dependency, settled lock entry/edge, errors, exports and lifecycle documentation. All other actual-main lock records are preserved, including node 1.25.13. Author and committer identities are canonical for all four commits.
• The execution evidence in the PR body remains associated with 75d966f9ca777a3638b2d071e5a957f37ae88f6f. No local Cargo, RED, resolver-metadata or probe run was performed for this ancestry cutover; new-head CI is separate integration evidence.

Details: TC-2220

[samgbafa]

Closed and reopened only to trigger CI after the retarget to main.